ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Confluence

v1.0.2

Read and write Confluence pages, search content, manage labels and comments. Use when user mentions Confluence, wiki, documentation, pages, or knowledge base.

⭐ 0· 92·0 current·0 all-time
byVuk Pejović@pejovicvuk
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
Name/description (Confluence) align with behavior: the included shell script talks only to Confluence REST endpoints. Minor inconsistency: the script requires curl and python3 (declared in the script header) but the registry metadata lists no required binaries — the script will fail if those binaries are absent.
✓
Instruction Scope
SKILL.md instructs the agent to run the bundled confluence-cli.sh and to use standard Confluence API calls. The instructions do not ask the agent to read unrelated files, other credentials, or to send data to third-party endpoints outside ATLASSIAN_URL.
ℹ
Install Mechanism
No install spec (instruction-only) and the script is bundled as a file. This is low-risk, but because the script will be executed from disk, users should confirm the script's origin (no homepage/source provided).
✓
Credentials
Required env vars (ATLASSIAN_URL, ATLASSIAN_EMAIL, ATLASSIAN_API_TOKEN) are exactly what a Confluence client needs. No unrelated secrets or extra services are requested.
✓
Persistence & Privilege
always is false and the skill does not request persistent system-wide privileges or modify other skills. It cannot force inclusion in all agent runs.
Assessment
This skill appears coherent and limited to Confluence Cloud operations. Before installing, verify you trust the skill source (no homepage or publisher info is provided). Make sure curl and python3 are available in the runtime environment (the registry metadata doesn't declare them). Understand that the ATLASSIAN_API_TOKEN and email will be used as basic auth against the ATLASSIAN_URL — only provide credentials you are willing to let this skill use. If you prefer more assurance, review the bundled confluence-cli.sh yourself or use an official/contributed Confluence client with a known provenance.

Like a lobster shell, security has layers — review code before you run it.

latestvk97apfqd39jnbv815phg4y4wwh83zpc6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📄 Clawdis
EnvATLASSIAN_URL, ATLASSIAN_EMAIL, ATLASSIAN_API_TOKEN

Comments